SOC Analyst L1

Summary

A Level 1 SOC Analyst job description involves initial security alert monitoring, investigation, and triage, often handling events following predefined runbooks.

Key responsibilities include using SIEM tools to analyze alerts, determining if they are false positives or actual threats, and escalating confirmed incidents to higher-level analysts.

Typical requirements are 1+ years of experience, knowledge of security concepts like phishing and malware, basic understanding of security tools (SIEM, EDR), and strong communication skills.

Responsibilities

• Monitor security alerts from various systems like SIEMs and EDRs.
• Perform initial investigation and analysis of security alerts to identify true threats versus false positives.
• Follow established playbooks and runbooks for incident handling.
• Escalate confirmed incidents to Level 2 analysts according to established service-level agreements (SLAs).
• Correlate logs from multiple sources to verify incidents.
• Document all actions taken during an investigation.
• Communicate with stakeholders about security events.

Qualifications and Skills

Experience: 1+ years in a cybersecurity role

Technical knowledge:

• Familiarity with Security Information and Event Management (SIEM) platforms like Splunk, Sentinel, Google SecOps, etc.
• Basic understanding of network security concepts and technologies (e.g., firewalls, IDS/IPS).
• Knowledge of security tools like Endpoint Detection and Response (EDR) and SOAR platforms is beneficial.
• Familiarity with operating systems, including log analysis on Windows and Linux.
• Understanding of cybersecurity frameworks like MITRE ATT&CK & NIST.

Soft skills:

• Strong analytical and problem-solving skills.
• Good communication in English, both written and verbal, for documentation and reporting.
• Ability to manage multiple tasks simultaneously.

Preferred:

• Relevant certifications like CompTIA Security+, Certified SOC Analyst, or similar.
• Scripting skill in Python, Bash, or PowerShell.

Work Arrangement

This role requires shift work, onsite presence, and may involve working at either the company's office or the client site, depending on project and business requirements.